Getting Data In

Reducing maxWarmDBCount below current warm bucket count.

mgherman
Explorer

Hi,

To utilise some additional space that I have brought online, I have configured the colddb path to use new storage and new warm-to-cold migrations are using the new storage.

Currently the maxWarmDBCount is set to the default (300) in the $SPLUNK_HOME/etc/system/default/indexes.conf, if I add a maxWarmDBCount setting to $SPLUNK_HOME/etc/system/local/indexes.conf at a value less than the number of warm buckets that currently exist, will splunk "do the right thing" and migrate the oldest warm buckets to the cold storage until it gets to the new maxWarmDBCount value?

Thanks again,

mgh

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Yes, once you restart splunkd and give it a little time to do so. It may not do it immediately upon restart, but it will notice there are currently more warm buckets than there are set to be, and it will roll the oldest ones to cold until it matches your policy.

mgherman
Explorer

As if by magic. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...